performance-expert
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill directs the agent to discover and load project-specific context, including architecture files and supplementary project-specific skills (e.g., [project]-performance-expert), which introduces a surface for indirect prompt injection.
- Ingestion points: .agent/SYSTEM/ARCHITECTURE.md and discovered project-specific performance skills.
- Boundary markers: Absent; no instructions are provided to the agent to distinguish between trusted guidance and external project data.
- Capability inventory: The skill utilizes command-line tools for profiling and testing (npm, node, k6).
- Sanitization: No sanitization or validation of the ingested files is described.
- [COMMAND_EXECUTION]: The references/full-guide.md file lists several shell commands for performance profiling, load testing, and bundle analysis that the agent is expected to execute. Evidence: 'k6 run load-test.js', 'node --prof app.js', 'npm run build', and 'ANALYZE=true npm run build'.
Audit Metadata